NOPASSWD: ALL is aimed at making all commands run without passwords. So ALL should be replaced by /bin/apt update. But overall you're right, I think. This syntax should be sufficient.
– Sergiy KolodyazhnyyJan 11 at 8:47